#pragma once
#include <Windows.h>
#include <winternl.h>
//#pragma comment(lib, "ntdll.lib")
//#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) < 0x80000000)
typedef struct _INAGE_RELOC
{
	WORD Offset : 12;
	WORD Type : 4;
} IMAGE_RELOC, * PIMAGE_RELOC;
/*typedef struct _UNICODE_STRING
{
	USHORT Length;
	USHORT MaximumLength;
	PWSTR Buffer;
} UNICODE_STR, * PUNICODE_STR, UNICODE_STRING, * PUNICODE_STRING;*/
typedef struct ___LDR_DATA_TABLE_ENTRY
{
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderLinks;
	LIST_ENTRY InInitializationOrderLinks;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	ULONG Flags;
	WORD LoadCount;
	WORD TlsIndex;
	LIST_ENTRY HashLinks;
	ULONG TimeDateStamp;
} __LDR_DATA_TABLE_ENTRY, * __PLDR_DATA_TABLE_ENTRY;
typedef struct  ___PEB_LDR_DATA
{
	DWORD Length;
	UCHAR Initialized;
	UCHAR Padding0[3];
	PVOID SsHandle;
	LIST_ENTRY InLoadOrderModuleList;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	PVOID EntryInProgress;
	UCHAR ShutdownInProgress;
	UCHAR Padding1[3];
	PVOID ShutdownThreadId;
}__PEB_LDR_DATA,*__PPEB_LDR_DATA;
#if _WIN64
typedef struct ___PEB
{
	BYTE InheritedAddressSpace;
	BYTE ReadImageFileExecOptions;
	BYTE BeingDebugged;
	union
	{
		BYTE BitField;
		struct
		{
			UCHAR ImageUsesLargePages : 1;
			UCHAR IsProtectedProcess : 1;
			BYTE IsImageDynamicallyRelocated : 1;
			UCHAR SkipPatchingUser32Forwarders : 1;
			BYTE IsPackagedProcess : 1;
			BYTE IsAppContainer : 1;
			BYTE IsProtectedProcessLight : 1;
			BYTE IsLongPathAwareProcess : 1;
		};
	};
	BYTE Padding0[4];
	PVOID Mutant;
	PVOID ImageBaseAddress;
	__PPEB_LDR_DATA Ldr;
	PVOID ProcessParameters;
}__PEB, * __PPEB;
#else
typedef PEB ___PEB, * __PPEB;
#endif

typedef NTSTATUS(WINAPI *_NtQueryInformationProcess)(
	HANDLE ProcessHandle,
	DWORD ProcessInformationClass,
	PVOID ProcessInformation,
	ULONG ProcessInformationLength,
	PULONG ReturnLength
);
typedef NTSTATUS(WINAPI* _NtUnmapViewOfSection)(
	HANDLE ProcessHandle,
	PVOID BaseAddress
	);
NTSTATUS WINAPI m_NtQueryInformationProcess(
	HANDLE ProcessHandle,
	DWORD ProcessInformationClass,
	PVOID ProcessInformation,
	ULONG ProcessInformationLength,
	PULONG ReturnLength
);
NTSTATUS WINAPI m_NtUnmapViewOfSection(
	HANDLE ProcessHandle,
	PVOID BaseAddress
);
HMODULE FindRemoteModule(HANDLE hProcess, LPCSTR lpModuleName,PDWORD pLength);

FARPROC GetRemoteProcAddress(HANDLE hProcess, HMODULE hModule, LPCSTR lpProcName ,DWORD moduleLength);

/*typedef struct _PROCESS_BASIC_INFORMATION {
	NTSTATUS ExitStatus;
	PVOID64 PebBaseAddress;
	ULONG_PTR AffinityMask;
	LONG BasePriority;
	ULONG_PTR UniqueProcessId;
	ULONG_PTR InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION, * PPROCESS_BASIC_INFORMATION;*/
